CVE-2019-12581: XSS
First published: Thu Jun 27 2019(Updated: )
A reflective Cross-site scripting (XSS) vulnerability in the free_time_failed.cgi CGI program in selected Zyxel ZyWall, USG, and UAG devices allows remote attackers to inject arbitrary web script or HTML via the err_msg parameter.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zyxel Uag2100 Firmware | <=4.18\(aaiz.1\)c0 | |
| Zyxel Uag2100 | ||
| Zyxel Uag4100 Firmware | <=4.18\(aatd.1\)c0 | |
| Zyxel Uag4100 | ||
| Zyxel Uag5100 Firmware | <=4.18\(aapn.1\)c0 | |
| Zyxel Uag5100 | ||
| Zyxel Usg110 Firmware | <=4.30 | |
| Zyxel Usg110 | ||
| Zyxel Usg210 Firmware | <=4.30 | |
| Zyxel Usg210 | ||
| Zyxel Usg310 Firmware | <=4.30 | |
| Zyxel Usg310 | ||
| Zyxel Usg1100 Firmware | <=4.30 | |
| Zyxel Usg1100 | ||
| Zyxel Usg1900 Firmware | <=4.30 | |
| Zyxel Usg1900 | ||
| Zyxel Usg2200-vpn Firmware | <=4.30 | |
| Zyxel Usg2200-vpn |
Remedy
https://sec-consult.com/en/blog/advisories/reflected-cross-site-scripting-in-zxel-zywall/index.html
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://n-thumann.de/blog/zyxel-gateways-missing-access-control-in-account-generator-xss/
- https://sec-consult.com/en/blog/advisories/reflected-cross-site-scripting-in-zxel-zywall/index.html
- https://www.zyxel.com/support/vulnerabilities-related-to-the-Free-Time-feature.shtml
- https://www.zyxel.com/us/en/
Frequently Asked Questions
What is the vulnerability ID for this XSS vulnerability?
The vulnerability ID for this XSS vulnerability is CVE-2019-12581.
What is the severity of CVE-2019-12581?
CVE-2019-12581 has a severity of medium with a CVSS score of 6.1.
Which devices are affected by CVE-2019-12581?
Selected Zyxel ZyWall, USG, and UAG devices are affected by CVE-2019-12581.
How can an attacker exploit CVE-2019-12581?
An attacker can exploit CVE-2019-12581 by injecting arbitrary web script or HTML via the err_msg parameter in the free_time_failed.cgi CGI program.
Are there any known fixes or patches for CVE-2019-12581?
Yes, there are fixes and patches available for CVE-2019-12581. It is recommended to update to the latest firmware versions provided by Zyxel.
- collector/nvd-index
- agent/weakness
- agent/references
- agent/severity
- agent/author
- agent/tags
- agent/event
- agent/type
- agent/description
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/zyxel
- canonical/zyxel uag2100 firmware
- version/zyxel uag2100 firmware/4.18\(aaiz.1\)c0
- canonical/zyxel uag2100
- canonical/zyxel uag4100 firmware
- version/zyxel uag4100 firmware/4.18\(aatd.1\)c0
- canonical/zyxel uag4100
- canonical/zyxel uag5100 firmware
- version/zyxel uag5100 firmware/4.18\(aapn.1\)c0
- canonical/zyxel uag5100
- canonical/zyxel usg110 firmware
- version/zyxel usg110 firmware/4.30
- canonical/zyxel usg110
- canonical/zyxel usg210 firmware
- version/zyxel usg210 firmware/4.30
- canonical/zyxel usg210
- canonical/zyxel usg310 firmware
- version/zyxel usg310 firmware/4.30
- canonical/zyxel usg310
- canonical/zyxel usg1100 firmware
- version/zyxel usg1100 firmware/4.30
- canonical/zyxel usg1100
- canonical/zyxel usg1900 firmware
- version/zyxel usg1900 firmware/4.30
- canonical/zyxel usg1900
- canonical/zyxel usg2200-vpn firmware
- version/zyxel usg2200-vpn firmware/4.30
- canonical/zyxel usg2200-vpn